Which cost optimization Istio 1.20 for Cilium: A Practical Guide

#!/bin/bash
# check-prereqs.sh: Validates cluster meets Istio 1.20 + Cilium cost optimization requirements
# Exit codes: 0 = all pass, 1 = critical failure, 2 = warning (non-blocking)

set -euo pipefail

# Configuration: minimum supported versions
MIN_K8S_MAJOR=1
MIN_K8S_MINOR=27
MIN_CILIUM=1.14.0
MIN_ISTIO=1.20.0
SUPPORTED_ARCH=amd64

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

check_k8s_version() {
  log_info "Checking Kubernetes version..."
  local k8s_version
  k8s_version=$(kubectl version -o json | jq -r '.serverVersion.gitVersion' | sed 's/v//')
  local major minor
  major=$(echo "$k8s_version" | cut -d. -f1)
  minor=$(echo "$k8s_version" | cut -d. -f2)

  if [[ "$major" -lt "$MIN_K8S_MAJOR" || ("$major" -eq "$MIN_K8S_MAJOR" && "$minor" -lt "$MIN_K8S_MINOR") ]]; then
    log_error "Kubernetes version $k8s_version is below minimum $MIN_K8S_MAJOR.$MIN_K8S_MINOR"
    exit 1
  fi
  log_info "Kubernetes version $k8s_version meets requirements"
}

check_cilium() {
  log_info "Checking Cilium installation..."
  if ! kubectl get namespace cilium &>/dev/null; then
    log_error "Cilium namespace not found. Install Cilium 1.14+ first: https://github.com/cilium/cilium"
    exit 1
  fi
  local cilium_version
  cilium_version=$(kubectl -n cilium exec deploy/cilium-operator -- cilium version | grep "Cilium:" | awk '{print $2}' | sed 's/v//')
  if [[ "$(printf '%s\n' "$MIN_CILIUM" "$cilium_version" | sort -V | head -n1)" != "$MIN_CILIUM" ]]; then
    log_error "Cilium version $cilium_version is below minimum $MIN_CILIUM"
    exit 1
  fi
  log_info "Cilium version $cilium_version meets requirements"
}

check_istio() {
  log_info "Checking Istio installation..."
  if ! kubectl get namespace istio-system &>/dev/null; then
    log_warn "Istio not installed. We will install Istio 1.20.1 in next step."
    return 2
  fi
  local istio_version
  istio_version=$(kubectl -n istio-system exec deploy/istiod -- pilot-discovery version | grep "Version:" | awk '{print $2}')
  if [[ "$(printf '%s\n' "$MIN_ISTIO" "$istio_version" | sort -V | head -n1)" != "$MIN_ISTIO" ]]; then
    log_error "Istio version $istio_version is below minimum $MIN_ISTIO"
    exit 1
  fi
  log_info "Istio version $istio_version meets requirements"
}

check_arch() {
  log_info "Checking node architecture..."
  local arch
  arch=$(kubectl get nodes -o jsonpath='{.items[0].status.nodeInfo.architecture}')
  if [[ "$arch" != "$SUPPORTED_ARCH" ]]; then
    log_warn "Architecture $arch is not officially validated. amd64 is supported. Proceed at risk."
    return 2
  fi
  log_info "Node architecture $arch is supported"
}

check_resources() {
  log_info "Checking cluster capacity..."
  local total_cpu total_mem
  total_cpu=$(kubectl get nodes -o jsonpath='{.items[*].status.allocatable.cpu}' | awk '{sum += $1} END {print sum}')
  total_mem=$(kubectl get nodes -o jsonpath='{.items[*].status.allocatable.memory}' | awk '{sum += $1} END {print sum}')
  if [[ "$total_cpu" -lt 8 || "$total_mem" -lt 16384 ]]; then
    log_warn "Cluster has less than 8 vCPU / 16Gi memory. Cost optimization gains will be limited."
    return 2
  fi
  log_info "Cluster has sufficient capacity: $total_cpu vCPU, $total_mem Mi memory"
}

main() {
  log_info "Starting prerequisite check for Istio 1.20 + Cilium cost optimization..."
  check_k8s_version
  check_cilium
  check_istio
  check_arch
  check_resources
  log_info "All critical prerequisites passed. Warnings above are non-blocking."
}

main "$@"

#!/bin/bash
# install-istio-cilium.sh: Installs Istio 1.20.1 with Cilium native sidecar support for cost optimization
# Requires: check-prereqs.sh passed, istioctl 1.20.1 installed locally

set -euo pipefail

# Configuration
ISTIO_VERSION=1.20.1
CILIUM_NAMESPACE=cilium
ISTIO_NAMESPACE=istio-system
SIDECAR_MEMORY_LIMIT=48Mi
SIDECAR_CPU_LIMIT=100m
ENABLE_CILIUM_NATIVE=true

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'

log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

install_istioctl() {
  log_info "Installing istioctl $ISTIO_VERSION..."
  if ! command -v istioctl &>/dev/null; then
    curl -L https://istio.io/downloadIstio | ISTIO_VERSION=$ISTIO_VERSION sh -
    export PATH="$PWD/istio-$ISTIO_VERSION/bin:$PATH"
    log_info "istioctl installed to $PWD/istio-$ISTIO_VERSION/bin"
  else
    local current_version
    current_version=$(istioctl version --short 2>/dev/null | head -n1 | sed 's/istioctl //')
    if [[ "$current_version" != "$ISTIO_VERSION" ]]; then
      log_error "istioctl version $current_version does not match required $ISTIO_VERSION"
      exit 1
    fi
  fi
}

generate_istio_operator() {
  log_info "Generating IstioOperator manifest with Cilium integration..."
  cat > istio-operator.yaml </dev/null || echo "")
  if [[ -z "$pod_name" ]]; then
    log_info "Deploying test httpbin workload..."
    kubectl apply -f https://raw.githubusercontent.com/istio/istio/1.20.1/samples/httpbin/httpbin.yaml
    kubectl -n default wait --for=condition=ready pod -l app=httpbin --timeout=300s
    pod_name=$(kubectl get pod -n default -l app=httpbin -o jsonpath='{.items[0].metadata.name}')
  fi
  # Check if sidecar is using Cilium native mode
  if kubectl -n default exec "$pod_name" -c istio-proxy -- curl -s http://localhost:15000/config_dump | grep -q "cilium"; then
    log_info "Cilium native sidecar mode is enabled for $pod_name"
  else
    log_error "Cilium native sidecar mode not detected. Check IstioOperator configuration."
    exit 1
  fi
}

main() {
  log_info "Starting Istio 1.20 + Cilium installation..."
  install_istioctl
  generate_istio_operator
  install_istio
  enable_namespace_injection
  validate_integration
  log_info "Installation complete. Proceed to cost monitoring setup."
}

main "$@"

#!/usr/bin/env python3
"""
calculate-mesh-cost.py: Calculates monthly service mesh cost for Istio + Cilium deployment
Requires: prometheus_client, boto3 (optional, for AWS cost integration)
Usage: python3 calculate-mesh-cost.py --prometheus-url http://prometheus:9090 --node-cost 0.096
"""

import argparse
import json
import os
import sys
from datetime import datetime, timedelta
from typing import Dict, List, Optional

import requests
from requests.exceptions import RequestException

# Configuration defaults
DEFAULT_PROM_URL = "http://prometheus.istio-system:9090"
DEFAULT_NODE_COST = 0.096  # AWS m5.2xlarge on-demand cost per hour
DEFAULT_NODE_CAPACITY_CPU = 8  # vCPU per node
DEFAULT_NODE_CAPACITY_MEM = 32768  # Mi per node

class MeshCostCalculator:
    def __init__(self, prom_url: str, node_cost: float):
        self.prom_url = prom_url
        self.node_cost = node_cost
        self.session = requests.Session()
        self.session.headers.update({"Content-Type": "application/json"})

    def query_prometheus(self, query: str) -> Optional[Dict]:
        """Execute PromQL query and return result"""
        try:
            resp = self.session.get(
                f"{self.prom_url}/api/v1/query",
                params={"query": query},
                timeout=10
            )
            resp.raise_for_status()
            return resp.json()
        except RequestException as e:
            print(f"[ERROR] Failed to query Prometheus: {e}", file=sys.stderr)
            return None

    def get_sidecar_metrics(self) -> Dict:
        """Get per-sidecar resource usage"""
        queries = {
            "total_sidecars": 'count(istio_agent_up{job="istio-proxy"})',
            "avg_mem_mi": 'avg(container_memory_usage_bytes{pod=~"istio-proxy.*", container="istio-proxy"} / 1024 / 1024)',
            "avg_cpu_cores": 'avg(rate(container_cpu_usage_seconds_total{pod=~"istio-proxy.*", container="istio-proxy"}[5m]))',
        }
        metrics = {}
        for key, query in queries.items():
            result = self.query_prometheus(query)
            if result and result.get("status") == "success":
                metrics[key] = float(result["data"]["result"][0]["value"][1])
            else:
                print(f"[WARN] Failed to get metric {key}, using default", file=sys.stderr)
                metrics[key] = 0.0
        return metrics

    def get_control_plane_metrics(self) -> Dict:
        """Get Istio control plane resource usage"""
        queries = {
            "istiod_cpu_cores": 'sum(rate(container_cpu_usage_seconds_total{pod=~"istiod.*", container="discovery"}[5m]))',
            "istiod_mem_mi": 'sum(container_memory_usage_bytes{pod=~"istiod.*", container="discovery"} / 1024 / 1024)',
            "cilium_cpu_cores": 'sum(rate(container_cpu_usage_seconds_total{namespace="cilium", container="cilium"}[5m]))',
            "cilium_mem_mi": 'sum(container_memory_usage_bytes{namespace="cilium", container="cilium"} / 1024 / 1024)',
        }
        metrics = {}
        for key, query in queries.items():
            result = self.query_prometheus(query)
            if result and result.get("status") == "success":
                metrics[key] = float(result["data"]["result"][0]["value"][1])
            else:
                print(f"[WARN] Failed to get metric {key}, using default", file=sys.stderr)
                metrics[key] = 0.0
        return metrics

    def calculate_node_usage(self, sidecar_metrics: Dict, cp_metrics: Dict) -> float:
        """Calculate total node capacity used by mesh components (0-1)"""
        total_cpu = (sidecar_metrics["avg_cpu_cores"] * sidecar_metrics["total_sidecars"]) + cp_metrics["istiod_cpu_cores"] + cp_metrics["cilium_cpu_cores"]
        total_mem = (sidecar_metrics["avg_mem_mi"] * sidecar_metrics["total_sidecars"]) + cp_metrics["istiod_mem_mi"] + cp_metrics["cilium_mem_mi"]

        # Assume CPU is the bottleneck for node count (simplification)
        nodes_needed_cpu = total_cpu / DEFAULT_NODE_CAPACITY_CPU
        nodes_needed_mem = total_mem / DEFAULT_NODE_CAPACITY_MEM
        return max(nodes_needed_cpu, nodes_needed_mem)

    def calculate_monthly_cost(self, nodes_used: float) -> float:
        """Calculate monthly cost (30 days * 24 hours)"""
        hourly_cost = nodes_used * self.node_cost
        monthly_cost = hourly_cost * 24 * 30
        return round(monthly_cost, 2)

    def generate_report(self) -> Dict:
        """Generate full cost report"""
        sidecar_metrics = self.get_sidecar_metrics()
        cp_metrics = self.get_control_plane_metrics()
        nodes_used = self.calculate_node_usage(sidecar_metrics, cp_metrics)
        monthly_cost = self.calculate_monthly_cost(nodes_used)

        return {
            "timestamp": datetime.utcnow().isoformat(),
            "sidecar_metrics": sidecar_metrics,
            "control_plane_metrics": cp_metrics,
            "nodes_used": round(nodes_used, 2),
            "monthly_cost_usd": monthly_cost,
            "cost_per_sidecar_usd": round(monthly_cost / sidecar_metrics["total_sidecars"], 2) if sidecar_metrics["total_sidecars"] > 0 else 0.0
        }

def main():
    parser = argparse.ArgumentParser(description="Calculate Istio + Cilium mesh cost")
    parser.add_argument("--prometheus-url", default=os.getenv("PROM_URL", DEFAULT_PROM_URL), help="Prometheus URL")
    parser.add_argument("--node-cost", type=float, default=DEFAULT_NODE_COST, help="Node cost per hour USD")
    args = parser.parse_args()

    calculator = MeshCostCalculator(args.prometheus_url, args.node_cost)
    try:
        report = calculator.generate_report()
        print(json.dumps(report, indent=2))
    except Exception as e:
        print(f"[ERROR] Failed to generate report: {e}", file=sys.stderr)
        sys.exit(1)

if __name__ == "__main__":
    main()

# Kyverno policy to auto-annotate injected pods with bandwidth limits
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-cilium-bandwidth-annotation
spec:
  rules:
  - name: annotate-istio-pods
    match:
      resources:
        kinds:
        - Pod
        namespaces:
          - default
          - istio-system
    mutate:
      patchStrategicMerge:
        metadata:
          annotations:
            cilium.io/bandwidth: "1G"
            cilium.io/bandwidth-burst: "2G"

# EnvoyFilter to disable access logs for dev namespace
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: disable-access-logs-dev
  namespace: dev
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          access_log:
          - name: envoy.access_loggers.file
            typed_config:
              "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog"
              path: /dev/null

# HPA for istiod using Cilium L7 request metrics
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: istiod-hpa
  namespace: istio-system
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: istiod
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Pods
    pods:
      metric:
        name: cilium_l7_requests_per_second
      target:
        type: AverageValue
        averageValue: "500"

istio-cilium-cost-optimization/
├── scripts/
│   ├── check-prereqs.sh       # Prerequisite validation (40+ lines)
│   ├── install-istio-cilium.sh # Istio 1.20 + Cilium install (40+ lines)
│   └── calculate-mesh-cost.py # Cost calculator (40+ lines)
├── manifests/
│   ├── istio-operator.yaml    # IstioOperator with Cilium integration
│   ├── kyverno-bandwidth.yaml # Bandwidth annotation policy
│   ├── istiod-hpa.yaml        # Istiod autoscaler config
│   └── envoyfilter-logs.yaml  # Access log disable filter
├── case-study/
│   └── fintech-metrics.json  # Raw benchmark data from case study
└── README.md                  # Guide overview and quick start